Youth Programs FAQ

The Privacy Policy for UW Youth Programs and related resources were developed by the Office of the Youth Protection Coordinator and the UW Privacy Office in consultation with the UW Division of the Attorney General’s Office and UW Compliance and Risk Services; reviewed by a focus group of UW Youth Programs and enhanced based on their feedback; and endorsed by the Privacy Steering Committee.

Personal data is any information that identifies or can identify an individual (either on its own or in conjunction with other information) such as:

• Name;
• Date of birth;
• Level of education;
• The school a participant attends; or
• Parent or guardian contact information.

Personal data can exist in any format, including:

• Hard copy or paper formats;
• Electronic or digital formats;
• Photographs;
• Video recordings; or
• Audio recordings.

A consenting participant is a participant in a UW Youth Program who has reached eighteen years of age. UW Youth Programs may provide the Privacy Notice for UW Youth Programs and any consent forms developed using the Privacy Consent Form Template directly to a consenting participant.

Examples of prohibited commercial data processing may include:

• Marketing of commercial goods or services to individuals;
• Use of an individual’s personal data to develop or improve a commercial good or service that does not yield a tangible benefit to participants in or operators of a UW Youth Program; and
• Sale or brokering of an individual’s personal data.

A UW Youth Program should identify strategies to minimize the amount of personal data it collects and, when possible, obtain less-identifying data points.

For example, a registration form may ask for a participant’s age and date of birth when an age range (ex. 5-8 years of age) could sufficiently inform age suitability for a UW Youth Program and be less identifying.

UW Youth Programs may engage a qualified translator to make the Privacy Notice for UW Youth Programs and any consent forms developed using the Privacy Consent Form Template available in other languages. Translations must be materially the same as the English language originals. UW Youth Programs are responsible for the integrity of any translations.

Please note that a Spanish PDF version of the Privacy Notice for UW Youth Programs is now available at Youth Privacy Notice – in Spanish (PDF). Accordingly, UW Youth Programs may not translate the Privacy Notice for UW Youth Programs into Spanish on their own. UW Youth Programs may, however, create Spanish versions of any consent forms developed using the Privacy Consent Form Template as described above.

For many UW Youth Programs, aligning practices with the Privacy Policy for UW Youth Programs and the related resources may require changes to existing operations and business processes. Accordingly, UW Youth Programs have until October 31, 2020 to fully implement the practices and principles identified in the Privacy Policy for UW Youth Programs and the related resources.

Yes. A UW Youth Program that independently makes decisions about and/or determines the means and purpose of their program or event (including administration, operations, activities, personal data processing, etc.) must follow the Privacy Policy for UW Youth Programs and use the related resources even if it engages with contractors.

Yes. A UW Youth Program that independently makes decisions about and/or determines the means and purpose of their program or event (including administration, operations, activities, personal data processing, etc.) must follow the Privacy Policy for UW Youth Programs and use the related resources even if it reports personal data to non-UW organizations that otherwise have no role in the control and operations of its UW Youth Program.

Examples of general audience events are graduation ceremonies and football games that welcome attendees of all ages.

An example of hosting youth with a non-UW chaperone is a 7th grade class field trip to the Burke Museum in which visiting youth are supervised by their school teacher and personal data relating to the visiting youth is not collected by UW.

An example of a program or event intended for youth who are admitted to the UW or registered in courses offered by a UW academic program is an early entrance program in which 10th-grade students withdraw from high school and enroll at UW.

An example of a program or event that collects personal data about individuals in the European Economic Area is a global language learning program in which youth located in Spain, Italy, and France are tutored via video conferencing.

An example of a non-UW organization that jointly makes decisions about and/or determines the means and purpose of a youth-focused program with UW is a third-party partner of a UW-based tutoring program that co-brands the initiative with UW; designs registration forms, curricula, tutoring strategies, and metrics for participant evaluation with UW; assigns its staff and volunteers to work alongside UW staff and volunteers with youth; and shares access to program databases containing participants’ personal data to administer the tutoring program with UW operators.

An example of a non-UW organization that solely makes decisions about and/or determines the means and purpose of a youth-focused program or event is a third-party summer camp that contracts with UW to provide staffing on its behalf and at its direction.

Depending on the nature of your program or event and/or your program or event’s involvement with third-parties, you may consider adopting and implementing some of the principles and practices detailed in the Privacy Policy for UW Youth Programs and the related resources as best practices. Programs and events that are outside of the scope of the Privacy Policy for UW Youth Programs may not disseminate or provide their constituents with access to the Privacy Notice for UW Youth Programs in connection with and as a representation of their own privacy practices. For questions about which principles and practices may be appropriate for your program or event, contact the UW Privacy Office at uwprivacy@uw.edu or 206-616-1238.

Short Answer: No.

Explanation: Depending on your position, when fulfilling experiential learning, internship, or other duties, you may interact with the external/non-UW entity’s constituents and their personal data. The personal data processed at an external/non-UW entity may be:

• Governed by laws or regulations with specific requirements about how the data are processed, used, and/or stored by the external/non-UW entity;
• Subject to UW policies; and/or
• Subject to the external/non-UW entity’s privacy and data protection policies.

When performing experiential learning, internships, or other duties at an external/non-UW entity (e.g., outside organization), UW students are performing those duties at the direction of the external entity, even though the experience may be required in order to advance UW students knowledge in an academic degree program. For example, when performing student teaching within a K-12 school a UW student-teacher is performing duties at the direction of the host school and the supervising teacher at the host school. As a result, the K-12 student data may be subject to the data privacy laws and regulations on the K-12 school, as well as that school district’s policies. Thus, any collection or use of the student’s data may be governed by the school district’s policies and FERPA.

Short Answer: It depends on the program activity and the technology. Review the specific technology listed in the FAQs below.

Explanation: Youth who are not enrolled students at the UW are often not eligible to receive an account to UW technology resources, and may or may not be able to access as an invitee. The license agreements for certain software may not include privacy protections for youth who are not students enrolled in an academic program at the UW.

For more information about UW-IT provided technology visit IT Connect or contact help@uw.edu.

Short Answer: Yes, though whether you need to provide notice or get consent depends on the type of activity and the age of the youth

Explanation: If the activity is related to:

• IRB approved research, follow the IRB Guidance on Involvement of Children in Research provided the Human Subjects Division
• UW Medicine and UW Healthcare Components patients, follow the patient information privacy policies provided by UW Medicine Compliance or contact comply@uw.edu.

If the activity is not related to the above IRB-approved research or UW Medicine patients, follow the UW Privacy Policy for UW Youth Programs, including use of the provided Privacy Notice and Privacy Consent forms.

Short Answer: Only with youth 13 and older.

Explanation: UW Canvas is available only to current students, faculty, and staff via UW NetID and only for courses listed in the UW Time Schedule. Units can purchase a separate instance of Canvas under UW contract for use with a variety of non-matriculated audiences, but the UW contract does not support use of these separate instances with youth under age 13.

For more information about Canvas review IT Connect – Canvas or contact help@uw.edu.

Short Answer: No.

Explanation: Panopto is available only for use by academic programs at the UW and by individuals with a UW NetID.

For more information about Panopto review IT Connect – Panopto or contact help@uw.edu.

Short Answer: No.

Explanation: Google Classroom is not enabled in UW G Suite due to a lack of operational capacity and G Suite platform engineering needed to support multiple learning management systems at the UW.

Short Answer: No.

Explanation: The UW has one enterprise agreement with Google for all UW-related activities.

Short Answer: No.

Explanation: The UW has one enterprise agreement with Google for all UW-related activities.

Short Answer: Yes, as long as it meets the below criteria.

Explanation: UW Google accounts are available only to current students, faculty, and staff via UW NetID. UW Google account holders can invite youth to complete a Google Forms as long as you:

• Register your activity with Youth Programs (not applicable to UW Medicine patient services).
• Provide proper notice or obtain consent per the Privacy Policy for UW Youth Programs or the applicable Office of Research or UW Medicine Compliance policy.
• Configure Google Forms and Meet in a secure manner before inviting participants to the Google Form or Meet.

For more information about G Suite review IT Connect – UW Google G Suite or contact help@uw.edu.

Short Answer: Yes, if the following criteria are met, youth may access meetings hosted through Teams as an invitee or participant.

Explanation: Microsoft Teams, as part of UW Office 365, is available only to current students, faculty, and staff via UW NetID. UW Office 365 account holders can create Teams meetings accessible to those without UW NetIDs, including youth as long as you:

• Register your activity with Youth Programs (not applicable to UW Medicine patient services).
• Provide proper notice or obtain consent per the Privacy Policy for UW Youth Programs or applicable Office of Research or UW Medicine patient privacy information policies).
• Configure UW Office 365 Teams in a secure manner before inviting participants to the Teams.

For more information about Office365 review IT Connect – UW Microsoft Office 365 or contact help@uw.edu.

Short Answer: It depends on their relationship to UW.

Explanation: UW Zoom accounts are available only to enrolled students, faculty, and staff via UW NetID. When performing UW activities, UW Zoom account holders can create meetings accessible to those without UW NetIDs, including youth. Review these FAQs for specific requirements.

Short Answer: No.

Explanation: The UW has one enterprise license with Zoom for all UW-related activities that prevents UW departments and units from entering into separate agreements with Zoom.

Short Answer: Follow UW Medicine’s patient privacy information policies

Explanation: Telehealth services related to patients at the UW hybrid entity must follow the patient privacy information policies provided by UW Medicine Compliance.

Short Answer: It depends on the type of data being processed.

Explanation: If the research is taking place in coordination with an external/non-UW entity (e.g., a K-12 school) the personal data processed at an external/non-UW entity may be:

• Governed by laws or regulations with specific requirements about how the data are processed, used, and/or stored by the external/non-UW entity;
• Subject to UW policies; and/or
• Subject to the external/non-UW entity’s privacy and data protection policies.

If the activity is related to IRB-approved research, ensure the technology solution for data collection and data processing protects the privacy of subjects and maintains the confidentiality of the data. For more information review the IRB Guidance on Involvement of Children in Research or contact the Office of Research, Human Subject Division.

In addition, if the research involves individuals at an external/non-UW entity, researchers may need to consult with the external/non-UW entity to identify an appropriate technology solution, which may be a solution other than UW-provided technology.

If the UW is the only organizational entity involved with the research, you may use UW Zoom to invite youth who are human subjects to a Zoom meeting as long as you:

• Obtain Institutional Review Board approval or HSD’s determination of exempt status for the research activity.
• Register your activity with Youth Programs.
• Comply with the applicable UW Office of Research guidance or UW Medicine patient privacy information policy.
• Provide proper notice or obtain consent per applicable Office of Research guidance or UW Medicine patient privacy information policy.
• Configure UW Zoom in a secure manner before inviting participants to the Zoom meeting.

Short Answer: Yes, as long as it meets the below criteria.

Explanation: UW Zoom accounts are available only to current students, faculty, and staff via UW NetID. UW Zoom account holders can invite youth to Zoom meetings as long as you:

• Register your activity in the Youth Program Registration System (not applicable to UW Medicine patient services).
• Comply with the UW Privacy Policy for Youth Programs.
• Provide proper notice or obtain consent per the Privacy Policy for UW Youth Programs.
• Configure UW Zoom in a secure manner before inviting participants to the Zoom meeting.

The Privacy Notice for UW Youth Programs should be provided when UW Youth Programs first collect personal data. Accordingly, a UW Youth Program must evaluate all of its business processes and data processing activities to identify when personal data is first collected or as soon as feasible thereafter.

For many UW Youth Programs, the first point of personal data collection may be in connection with an application or registration form. Accordingly, applications and registration forms should be accompanied by the Privacy Notice for UW Youth Programs either as an additional printed document (if applications or registration forms are distributed in paper format) or through a hyperlink (if applications or registration forms are completed online or transmitted via email).

Consider keeping the Privacy Notice for UW Youth Programs distinct and separate from other materials by printing and stapling the Privacy Notice for UW Youth Programs as a single document and using colored paper.

UW Youth Programs must limit personal data process to the original purpose and activities described in the Privacy Notice for UW Youth Programs. New or secondary data processing activities that are unrelated to and/or inconsistent with the original purpose for data processing may require supplemental notice and consent. Before processing any personal data for a new or secondary purpose, please consult with the UW Privacy Office at uwprivacy@uw.edu or 206-616-1238.

Yes, your UW Youth Program should still disseminate the Privacy Notice for UW Youth Programs. The Privacy Notice for UW Youth Programs describes practices across all in-scope UW Youth Programs at the UW rather than unique practices in individual UW Youth Programs. Notably, the Privacy Notice for UW Youth Programs informs parents, guardians, and consenting participants that “Depending on the nature of a UW Youth Program, some or all of the personal data described [therein] may be collected and used…”

Accordingly, UW Youth Programs are neither required nor encouraged to engage in all data processing activities described in the Privacy Notice for UW Youth Programs. Rather, UW Youth Programs are prohibited from engaging in any data processing activities that are not already included in the Privacy Notice for UW Youth Programs. If your UW Youth Program seeks to engage in an activity not already described in the Privacy Notice for UW Youth Programs, please read the preceding FAQ.

As detailed in the Privacy Notice for UW Youth Programs, prior consent is required before engaging in any of the following data processing activities:

• Sending communications relating to announcements, assignments, logistics, mentoring, or similar matters to participants who are under 13 years of age during a UW Youth Program;
• Sending communications about other UW Youth Programs that may be of interest to participants;
• Sharing personal data within UW for prospective student recruiting;
• Sharing personal data with a third-party (ex. funding partner) for reporting that is optional for a UW Youth Program;
• Publishing photos, videos, audio recordings, or content created by participants in promotional materials of a UW Youth Program and/or the UW such as brochures, online content, etc.; or
• Featuring photos, videos, audio recordings, or content created by participants on a UW Youth Program bulletin board, blog, newsletter, or through a similar publicly-accessible medium.

Affirmative consent is permission for a proposed activity that is given by an individual actively, voluntarily, clearly, and with sufficient knowledge about the data processing.

The Privacy Consent Form Template for UW Youth Programs is a mechanism for UW Youth Programs to obtain affirmative consent for certain practices that warrant additional reflection (ex. communications with minors under the age of 13 via email or text message, etc.).

As contrast to affirmative consent, inactive, passive, or inferred consent does not involve meaningful action by an individual. For example, a disclaimer that states “by participating in this program or event, you consent to personal data processing” is not affirmative consent. Similarly, a pre-checked box in an online consent form does not constitute affirmative consent as it does not reflect deliberate individual action. Consent should not be relied upon unless it is affirmative.

Just-in-time consent is solicited just before personal data is processed for an activity that requires consent.

For example, a UW Youth Program may provide the Privacy Notice for UW Youth Programs in March when it begins its summer day camp registration (i.e., the first point of personal data collection). In July, the UW Youth Program receives a reporting request from its funding partner to voluntarily submit identifiable demographic information for funding-related analysis. Since the UW Youth Program did not obtain consent in March during its registration period, it would need to obtain consent in July through the use of a consent form just before sharing identifiable demographic information with its funding partner.

Consider keeping your UW Youth Program’s finalized consent form distinct and separate from other materials by printing and stapling the finalized consent form as a single document and using colored paper.

UW Youth Programs must evaluate the entirety of their operations and business processes to identify any data processing that would involve consent obtained from individuals. A UW Youth Program’s operations and business processes need to be designed with mechanisms that allow for individual choices to be honored.

For example, if a UW Youth Program sends participants under the age of 13 emails about assignments or event logistics, it should only include those participants for whom consent has been obtained in its email distribution lists. As an alternative to emailing a participant under the age of 13, UW Youth Programs may email the participant’s parent or guardian or, alternatively, make assignments or event logistics visible online or available in paper form.

UW Youth Programs should consider dedicated environments where participants can engage in program or event activities without being exposed to photography or recordings that require prior consent.

For example, in a computer lab space with a mix of participants for whom consent has and has not been obtained for promotional photography or recordings, consider reserving a limited number of computer stations as photography-friendly spaces while directing participants for whom consent has not been obtained to the remaining computer stations that are designated as being free of photography. To the extent it is age-appropriate, consider utilizing signs or posted notices to visually distinguish photography-friendly spaces from photography-free spaces.